CVE-2023-3605
published 2023-07-10CVE-2023-3605: A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown…
PriorityP351critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.68%
48.4th percentile
A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Registration Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233467.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpgurukul | online_shopping_portal | — | — |
| vyperlang | vyper | >= 0.2.9 < 0.3.10 | 0.3.10 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Vyper has incorrect re-entrancy lock when key is empty string
ghsa·2023-09-18
CVE-2023-42441 [MEDIUM] CWE-667 Vyper has incorrect re-entrancy lock when key is empty string
Vyper has incorrect re-entrancy lock when key is empty string
### Impact
Locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime.
```Vyper
@nonreentrant("") # unprotected
@external
def bar():
pass
@nonreentrant("lock") # protected
@external
def foo():
pass
```
### Patches
Patched in #3605
### Workarounds
The lock name should be a non-empty string.
### References
_Are there any links users can visit to find out more?_
GHSA
GHSA-j52c-x4fq-cc7v: A vulnerability was found in PHPGurukul Online Shopping Portal 1
ghsa_unreviewed·2023-07-10
CVE-2023-3605 [MEDIUM] CWE-307 GHSA-j52c-x4fq-cc7v: A vulnerability was found in PHPGurukul Online Shopping Portal 1
A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Registration Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233467.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-07-10
Published